apache-vhost.conf

<VirtualHost *:80>

	# based on https://github.com/ioerror/duraconf/blob/master/configs/apache2/https-hsts.conf

	ServerAdmin admin@example.com
	ServerName example.com

	DocumentRoot /var/www

	RedirectPermanent /      https://example.com/

	ErrorLog ${APACHE_LOG_DIR}/error.log
	CustomLog ${APACHE_LOG_DIR}/access.log combined

	ServerSignature Off

</VirtualHost>

<VirtualHost *:443>

	ServerAdmin admin@example.com
	ServerName example.com

	SSLEngine on
	SSLCertificateFile /etc/apache2/ssl/root.crt
	SSLCertificateKeyFile /etc/apache2/ssl/root.pem
	SSLCACertificateFile /etc/apache2/ssl/ca.pem

	SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
	# BEAST mitigation, but RC4
	# SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
	
	# from http://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
	# Forward Secrecy, but no BEAST mitigation
	SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AES:RSA+3DES:!ADH:!AECDH:!MD5:!DSS:!aNULL
	SSLHonorCipherOrder on
	SSLCompression off

	# export cipher variables
	SSLOptions +StdEnvVars 

	# Add six earth month HSTS header for all users, protect all Subdomains
	Header append Strict-Transport-Security "max-age=15768000 ; includeSubDomains"

	# mitigate TIME attack
	Header always append X-Frame-Options "sameorigin"

	DocumentRoot /var/www/

	# Server Side Includes
	<Directory "/var/www/wasuptls">
		Options +IncludesNOEXEC
		XBitHack On
	</Directory>

	ErrorLog ${APACHE_LOG_DIR}/error.log
	CustomLog ${APACHE_LOG_DIR}/access.log combined

	ServerSignature Off

</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet